CVE-2026-52766 Details
Description
YesWiki is a wiki system written in PHP. Prior to version 4.6.6, the {{erasespamedcomments}} wiki action (actions/EraseSpamedCommentsAction.php) accepts a suppr[] array from POST and deletes every wiki page whose tag appears in that array, with no authorization check anywhere in the action body or in the page-deletion path it invokes. Combined with YesWiki's allow-by-default action ACL model, any user who has page write access, which is the default for everyone (default_write_acl='*') on a fresh install can permanently delete arbitrary wiki pages, including the front page, admin pages, and pages owned by other users. This issue has been patched in version 4.6.6.
A vulnerability in YesWiki versions prior to 4.6.6 allows for unauthenticated users to delete arbitrary wiki pages. The issue arises from the {{erasespamedcomments}} action, which accepts a suppr[] array via POST and deletes pages based on the tags provided, without any authorization checks. This vulnerability exploits YesWiki's default allow-by-action ACL model, enabling any user with page write access to permanently remove pages, including the front page and admin pages.
Users are advised to upgrade to YesWiki version 4.6.6, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 5, 2026CISA-ADP
Assessed Sep 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6x7x-gcmf-7r8x | CISA-ADP | AdvisoryExploitRemedyVendor |
| https://github.com/YesWiki/yeswiki/commit/ed5b548a705c8091ba0282aaaba73ddda976abef | [email protected] | Source CodeVendor |
| https://github.com/YesWiki/yeswiki/releases/tag/v4.6.6 | [email protected] | Release NotesVendor |
| https://github.com/YesWiki/yeswiki/security/advisories/GHSA-6x7x-gcmf-7r8x | [email protected] | AdvisoryExploitRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-276 | Incorrect Default Permissions | [email protected] |
| CWE-862 | Missing Authorization | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| YesWiki | <= 4.6.5 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 9, 2026 | CVE Modified | CISA-ADP |
| Sep 5, 2026 | New CVE Received | [email protected] |